1. 下载go二进制包并配置环境
[maaiqiang@localhost ~]$ cd /usr/local/src/
[maaiqiang@localhost ~]$ wget https://dl.google.com/go/go1.13.8.linux-amd64.tar.gz
[maaiqiang@localhost ~]$ tar -C /usr/local -xzf go1.13.8.linux-amd64.tar.gz
[maaiqiang@localhost ~]$ echo “export PATH=$PATH:/usr/local/go/bin” >> /etc/profile
[maaiqiang@localhost ~]$ source /etc/profile
[maaiqiang@localhost ~]$ go version
2. 下载kubernetes v1.17.4源码包
[maaiqiang@localhost ~]$ cd /usr/local/src/
[maaiqiang@localhost ~]$ wget https://github.com/kubernetes/kubernetes/archive/v1.17.4.tar.gz
[maaiqiang@localhost ~]$ tar -xf v1.17.4.tar.gz
[maaiqiang@localhost ~]$ cd kubernetes–1.17.4/
2.1 修改有效期限制为100年
[maaiqiang@localhost ~]$ vim cmd/kubeadm/app/util/pkiutil/pki_helpers.go
NotAfter: time.Now().Add(kubeadmconstants.CertificateValidity * 100).UTC() # 修改成100年
2.2 修改有效期限制为100年
[maaiqiang@localhost ~]$ vim staging/src/k8s.io/client-go/util/cert/cert.go
NotAfter: now.Add(duration365d * 100).UTC(),
NotAfter: validFrom.Add(maxAge * 100)
NotAfter: validFrom.Add(maxAge * 100),
3. 重新编译
[maaiqiang@localhost ~]$ make all WHAT=cmd/kubeadm GOFLAGS=-v
4. 使用编译后的 kubeadm文件替换官方原 kubeadm
# 获取kubeadm文件位置
[maaiqiang@localhost ~]$ which kubeadm
[maaiqiang@localhost ~]$ cp /usr/local/src/kubernetes–1.17.4/_output/local/bin/linux/amd64/kubeadm /usr/bin
5. 验证
[maaiqiang@localhost ~]$ kubeadm alpha certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml'
CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED
admin.conf Apr 07, 2021 07:39 UTC 364d no
apiserver Apr 07, 2021 07:39 UTC 364d ca no
apiserver-etcd-client Apr 07, 2021 07:39 UTC 364d etcd-ca no
apiserver-kubelet-client Apr 07, 2021 07:39 UTC 364d ca no
controller-manager.conf Apr 07, 2021 07:40 UTC 364d no
etcd-healthcheck-client Apr 07, 2021 07:40 UTC 364d etcd-ca no
etcd-peer Apr 07, 2021 07:40 UTC 364d etcd-ca no
etcd-server Apr 07, 2021 07:40 UTC 364d etcd-ca no
front-proxy-client Apr 07, 2021 07:40 UTC 364d front-proxy-ca no
scheduler.conf Apr 07, 2021 07:40 UTC 364d no
CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED
ca Mar 12, 2030 02:18 UTC 9y no
etcd-ca Mar 12, 2030 02:18 UTC 9y no
front-proxy-ca Mar 12, 2030 02:18 UTC 9y no
[maaiqiang@localhost ~]$ kubeadm alpha certs renew all
[renew] Reading configuration from the cluster...
[renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml'
certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed
certificate for serving the Kubernetes API renewed
certificate the apiserver uses to access etcd renewed
certificate for the API server to connect to kubelet renewed
certificate embedded in the kubeconfig file for the controller manager to use renewed
certificate for liveness probes to healthcheck etcd renewed
certificate for etcd nodes to communicate with each other renewed
certificate for serving etcd renewed
certificate for the front proxy client renewed
certificate embedded in the kubeconfig file for the scheduler manager to use renewed
[root@k8s-master kubernetes-1.17.4]# kubeadm alpha certs check-expiration
[check-expiration] Reading configuration from the cluster...
[check-expiration] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml'
CERTIFICATE EXPIRES RESIDUAL TIME CERTIFICATE AUTHORITY EXTERNALLY MANAGED
admin.conf Mar 14, 2120 08:29 UTC 99y no
apiserver Mar 14, 2120 08:29 UTC 99y ca no
apiserver-etcd-client Mar 14, 2120 08:29 UTC 99y etcd-ca no
apiserver-kubelet-client Mar 14, 2120 08:29 UTC 99y ca no
controller-manager.conf Mar 14, 2120 08:29 UTC 99y no
etcd-healthcheck-client Mar 14, 2120 08:29 UTC 99y etcd-ca no
etcd-peer Mar 14, 2120 08:29 UTC 99y etcd-ca no
etcd-server Mar 14, 2120 08:29 UTC 99y etcd-ca no
front-proxy-client Mar 14, 2120 08:29 UTC 99y front-proxy-ca no
scheduler.conf Mar 14, 2120 08:29 UTC 99y no
CERTIFICATE AUTHORITY EXPIRES RESIDUAL TIME EXTERNALLY MANAGED
ca Mar 12, 2030 02:18 UTC 9y no
etcd-ca Mar 12, 2030 02:18 UTC 9y no
front-proxy-ca Mar 12, 2030 02:18 UTC 9y no